# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1175 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1176 --- ## [Frozen Tier CPU spikes - in relation to siem alerts](https://discuss.elastic.co/t/frozen-tier-cpu-spikes-in-relation-to-siem-alerts/288214)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 8\ **Last updated:** [November 4, 2021, 2:29pm UTC](https://discuss.elastic.co/t/frozen-tier-cpu-spikes-in-relation-to-siem-alerts/288214 "2021-11-04T14:29:59Z")
I have a been reconfiguring my elastic cloud setup to try and improve performance. I created a frozen tier node, alot of indices have moved from warm to searchable snapshots. However looking at the CPU of the frozen node… --- ## [Node won’t start up due to duplicate alias/index names (HELP)](https://discuss.elastic.co/t/node-won-t-start-up-due-to-duplicate-alias-index-names-help/288123)
**Author:** [@Rabih\_harb](https://discuss.elastic.co/u/Rabih_harb)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 2:08pm UTC](https://discuss.elastic.co/t/node-won-t-start-up-due-to-duplicate-alias-index-names-help/288123 "2021-11-04T14:08:27Z")
Dear community, we have a major issue in our production cluster (2.4.6): previous cluster setup: 4 nodes ( master and data) the upgrade done on the cluster was: 4 nodes---\> set as data only master false. 2 additio… --- ## [How to collect last 10 day debug logs of kibana 7.14.0 to 10 files](https://discuss.elastic.co/t/how-to-collect-last-10-day-debug-logs-of-kibana-7-14-0-to-10-files/288201)
**Author:** [@nuaazt](https://discuss.elastic.co/u/nuaazt)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 2:00pm UTC](https://discuss.elastic.co/t/how-to-collect-last-10-day-debug-logs-of-kibana-7-14-0-to-10-files/288201 "2021-11-04T14:00:49Z")
hi, I have downloaded a kibana 7.14.0 docker image. I noted that there are a lot of introduce about debug log settings. Now I want to collect the last 10 day debug logs of kibana. And the log should be written one f… --- ## [Filtering data before search](https://discuss.elastic.co/t/filtering-data-before-search/288409)
**Author:** [@Victor\_Dusautois](https://discuss.elastic.co/u/Victor_Dusautois)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 1:45pm UTC](https://discuss.elastic.co/t/filtering-data-before-search/288409 "2021-11-04T13:45:53Z")
Hello, I am trying what I thought was going to be an easy fix with Elasticsearch. It appears I'm stumbling on achieving a sort on a simple name field containing civility: Here is some sample (fake) data: \[ { "name… --- ## [How can i get more documents about how to build a kibana glugin?](https://discuss.elastic.co/t/how-can-i-get-more-documents-about-how-to-build-a-kibana-glugin/288396)
**Author:** [@qinzehua](https://discuss.elastic.co/u/qinzehua)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 1:43pm UTC](https://discuss.elastic.co/t/how-can-i-get-more-documents-about-how-to-build-a-kibana-glugin/288396 "2021-11-04T13:43:24Z")
I have read the deveoper guid, but it seems too concise. Is there any more documentation about the development interface? For example, the introduction of files in the directories src/core/server and src/core/public. --- ## [Logstash - parse/ filter lines having a specific string](https://discuss.elastic.co/t/logstash-parse-filter-lines-having-a-specific-string/288103)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [November 4, 2021, 1:35pm UTC](https://discuss.elastic.co/t/logstash-parse-filter-lines-having-a-specific-string/288103 "2021-11-04T13:35:26Z")
Hi All, We are running ELK 7.6.2 stack in our environment. The log generated by our application throws out messages with different Log Levels. Please see below example: 2021-10-31 19:00:01,062|DEBUG|DispatcherServlet… --- ## [Elasticsearch filter failing to start with logstash because of cluster not being available yet](https://discuss.elastic.co/t/elasticsearch-filter-failing-to-start-with-logstash-because-of-cluster-not-being-available-yet/287843)
**Author:** [@Mrizzi](https://discuss.elastic.co/u/Mrizzi)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 1:18pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-failing-to-start-with-logstash-because-of-cluster-not-being-available-yet/287843 "2021-11-04T13:18:59Z")
Hi everyone! Hope you're doing okay, i'm making this post because I couldn't find anything online about the following issue and I wanted to make sure i'm not overlooking something simple. I have the stack installed in … --- ## [Esrally "Could not connect to your Elasticsearch metrics store."](https://discuss.elastic.co/t/esrally-could-not-connect-to-your-elasticsearch-metrics-store/288403)
**Author:** [@gabbar](https://discuss.elastic.co/u/gabbar)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 12:48pm UTC](https://discuss.elastic.co/t/esrally-could-not-connect-to-your-elasticsearch-metrics-store/288403 "2021-11-04T12:48:39Z")
Hello Elasticworld, I'm striving to run a race on my test cluster, but it's apparently not able to connect to ES I'm running 2 ES 6.8.18 nodes running on RH 7.9 rally runs from RH 8.4 \[esrally@uttest01 ~\]$ esrally --… --- ## [Filebeat isn't keeping up with our logs](https://discuss.elastic.co/t/filebeat-isnt-keeping-up-with-our-logs/288398)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 0\ **Last updated:** [November 4, 2021, 11:03am UTC](https://discuss.elastic.co/t/filebeat-isnt-keeping-up-with-our-logs/288398 "2021-11-04T11:03:33Z")
Filebeat 6.8.20 running on CentOS 7.9 We're using Filebeat to send some logs to our Elasticsearch cluster (by way of Logstash and a Kafka layer which provides retention in case of cluster downtime) and as the data volum… --- ## [EQL Sequence and elapsed time calculation](https://discuss.elastic.co/t/eql-sequence-and-elapsed-time-calculation/288101)
**Author:** [@Iriana\_Arguedas](https://discuss.elastic.co/u/Iriana_Arguedas)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 10:39am UTC](https://discuss.elastic.co/t/eql-sequence-and-elapsed-time-calculation/288101 "2021-11-04T10:39:20Z")
With EQL is easy to identify when a process was executed/started and when it did finish. Is there a way to calculate the elapsed time of the execution inside the EQL query? Or is it better to use an external tool to pr… --- ## [Collapse performance with heavy operations](https://discuss.elastic.co/t/collapse-performance-with-heavy-operations/288085)
**Author:** [@DrParanoia](https://discuss.elastic.co/u/DrParanoia)\ **Replies:** 11\ **Last updated:** [November 4, 2021, 10:11am UTC](https://discuss.elastic.co/t/collapse-performance-with-heavy-operations/288085 "2021-11-04T10:11:30Z")
DISCLAIMER: I am relatively new to Elasticsearch, so I apologize in case my question is too "basic" or falls into "everybody should know this" category :smile: Hi! I have a performance question. Let's say, we have this … --- ## [Elasticsearch log "level": "WARN" "component": "r.suppressed" "message": "path: /\_prometheus/metrics, params: {}"](https://discuss.elastic.co/t/elasticsearch-log-level-warn-component-r-suppressed-message-path-prometheus-metrics-params/288394)
**Author:** [@Farzad\_Ebrahimi](https://discuss.elastic.co/u/Farzad_Ebrahimi)\ **Replies:** 0\ **Last updated:** [November 4, 2021, 9:04am UTC](https://discuss.elastic.co/t/elasticsearch-log-level-warn-component-r-suppressed-message-path-prometheus-metrics-params/288394 "2021-11-04T09:04:11Z")
Hi everyone, i have one node Elasticsearch:7.12.0 in docker with this configs: environment: - bootstrap.memory\_lock=true - "ES\_JAVA\_OPTS=-Xms31G -Xmx31G" - cluster.routing.allocation.disk.threshold\_enabled=… --- ## [Manually import data from indices folder](https://discuss.elastic.co/t/manually-import-data-from-indices-folder/288388)
**Author:** [@Tojo\_Rakotoarimanana](https://discuss.elastic.co/u/Tojo_Rakotoarimanana)\ **Replies:** 5\ **Last updated:** [November 4, 2021, 8:59am UTC](https://discuss.elastic.co/t/manually-import-data-from-indices-folder/288388 "2021-11-04T08:59:35Z")
Hello all, For unknown reason, our index was deleted automatically. we have a backup but just the folder in path.data, no snapshot. is there any tricky method to import index from this backup? thanks --- ## [Adding a new translation to Kibana and distribute it](https://discuss.elastic.co/t/adding-a-new-translation-to-kibana-and-distribute-it/287185)
**Author:** [@nkatsaounos](https://discuss.elastic.co/u/nkatsaounos)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 8:52am UTC](https://discuss.elastic.co/t/adding-a-new-translation-to-kibana-and-distribute-it/287185 "2021-11-04T08:52:05Z")
Hello, I have started localization Kibana to greek language. I made my experiments in an Ubuntu20.04 system. I made the following changes after cloning development code from kibana repo: extracted en.json file via no… --- ## [How to filter with pipeline aggregations in all aggregated results](https://discuss.elastic.co/t/how-to-filter-with-pipeline-aggregations-in-all-aggregated-results/288340)
**Author:** [@elina](https://discuss.elastic.co/u/elina)\ **Replies:** 0\ **Last updated:** [November 3, 2021, 3:12pm UTC](https://discuss.elastic.co/t/how-to-filter-with-pipeline-aggregations-in-all-aggregated-results/288340 "2021-11-03T15:12:52Z")
Hi! I'm working on a project with elasticseach. I'am stuck with the below problem. I can't figure this out no matter what I have tried so far. Firstly, I would like to group by "keyword" in buckets using the terms aggre… --- ## [Elastic 2.4 Compatibility matrix](https://discuss.elastic.co/t/elastic-2-4-compatibility-matrix/288307)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 4\ **Last updated:** [November 4, 2021, 8:20am UTC](https://discuss.elastic.co/t/elastic-2-4-compatibility-matrix/288307 "2021-11-04T08:20:40Z")
hey there, is there a link to a compatibility matrix related to Elasticsearch 2.4? I know its EOL, I would like to know any compatibility with Java, OS and so on.... thanks --- ## [Importing data to elasticsearch from multiple dynamic databases](https://discuss.elastic.co/t/importing-data-to-elasticsearch-from-multiple-dynamic-databases/288317)
**Author:** [@enricog84](https://discuss.elastic.co/u/enricog84)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 8:31am UTC](https://discuss.elastic.co/t/importing-data-to-elasticsearch-from-multiple-dynamic-databases/288317 "2021-11-04T08:31:37Z")
Hi, I am currently evaluating (and have no further experience so far) the ELK stack. I am wondering if it would be possible to import data from multiple dynamic created MariaDB databases into Elasticsearch. Short back… --- ## [Technicality on throughput-based cluster sizing](https://discuss.elastic.co/t/technicality-on-throughput-based-cluster-sizing/288346)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 8:27am UTC](https://discuss.elastic.co/t/technicality-on-throughput-based-cluster-sizing/288346 "2021-11-04T08:27:26Z")
Hello, I have a question about sizing an Elasticsearch cluster based on throughput. I'm following this webinar: Elasticsearch sizing and capacity planning. If I understood correctly, the throughput-based sizing method… --- ## [Metricbeat Logstash module payload size](https://discuss.elastic.co/t/metricbeat-logstash-module-payload-size/287247)
**Author:** [@admlko](https://discuss.elastic.co/u/admlko)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 7:49am UTC](https://discuss.elastic.co/t/metricbeat-logstash-module-payload-size/287247 "2021-11-04T07:49:57Z")
Hi, I opened a ticket about this issue in the github, but it got closed and the issue was redirected here: https://github.com/elastic/beats/issues/28569 It is my understanding that the Logstash UDP output plugin doesn'… --- ## [ElasticSearch relational data](https://discuss.elastic.co/t/elasticsearch-relational-data/288387)
**Author:** [@muhammadahmad](https://discuss.elastic.co/u/muhammadahmad)\ **Replies:** 0\ **Last updated:** [November 4, 2021, 7:31am UTC](https://discuss.elastic.co/t/elasticsearch-relational-data/288387 "2021-11-04T07:31:11Z")
Hello , I need some help in managing following data, for example , I have five entities A, B, C, D ,E A has one to many relation with B, B has one to many relation with C, C has One to many relation with D, D has … --- ## [How to access logstash keystore in jvm.options?](https://discuss.elastic.co/t/how-to-access-logstash-keystore-in-jvm-options/287906)
**Author:** [@bhargaviaaa](https://discuss.elastic.co/u/bhargaviaaa)\ **Replies:** 4\ **Last updated:** [November 4, 2021, 5:31am UTC](https://discuss.elastic.co/t/how-to-access-logstash-keystore-in-jvm-options/287906 "2021-11-04T05:31:38Z")
Please provide example to access logstash keystore in jvm.options. --- ## [Warm indices is not compressed](https://discuss.elastic.co/t/warm-indices-is-not-compressed/288288)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 18\ **Last updated:** [November 4, 2021, 4:59am UTC](https://discuss.elastic.co/t/warm-indices-is-not-compressed/288288 "2021-11-04T04:59:44Z")
I read on elastic documentation that warm phase could reduce index size, but it didn't state clearly how much index will be compressed on warm phase. It is stated that warm phase also have shrink and force merge featur… --- ## [(Issue) Logstash JDBC Input Plugin seems to be changing datetime column value's at output](https://discuss.elastic.co/t/issue-logstash-jdbc-input-plugin-seems-to-be-changing-datetime-column-values-at-output/288353)
**Author:** [@GPartenza](https://discuss.elastic.co/u/GPartenza)\ **Replies:** 4\ **Last updated:** [November 4, 2021, 3:20am UTC](https://discuss.elastic.co/t/issue-logstash-jdbc-input-plugin-seems-to-be-changing-datetime-column-values-at-output/288353 "2021-11-04T03:20:48Z")
Hello, I have an SQLite database where new data is written every second. Currently, I am using Logstash and its JDBC plugin to read the data in real-time and ship it to Elasticsearch for visualization. Everything is wor… --- ## [How to identify the errors reported by logstash?](https://discuss.elastic.co/t/how-to-identify-the-errors-reported-by-logstash/288283)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 5\ **Last updated:** [November 4, 2021, 3:05am UTC](https://discuss.elastic.co/t/how-to-identify-the-errors-reported-by-logstash/288283 "2021-11-04T03:05:33Z")
I can't understand where is the error? Who can share how to quickly identify the specific location of the error? input { elasticsearch { hosts =\> \["192.168.10.141:9200"\] index =\> "apm-\*-error-\*" query =\> '{ "query… --- ## [Cluster restore with security on - with what users..?](https://discuss.elastic.co/t/cluster-restore-with-security-on-with-what-users/288292)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 1:14am UTC](https://discuss.elastic.co/t/cluster-restore-with-security-on-with-what-users/288292 "2021-11-04T01:14:34Z")
Hi Elastic 7.15 My question is. When security is on, whenever I need to restore data to a new cluster, then how I am supposed to do that..? I mean, I install necessary packages, replace all the configuration files, th… --- ## [Gz file handling by interaction as XML files](https://discuss.elastic.co/t/gz-file-handling-by-interaction-as-xml-files/288002)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 6\ **Last updated:** [November 4, 2021, 1:09am UTC](https://discuss.elastic.co/t/gz-file-handling-by-interaction-as-xml-files/288002 "2021-11-04T01:09:42Z")
Hi How Can I configure input for reading per only one file. It is very important that logstash reads one file at a time as soon as it finishes parsing it and reads another one. This is related to the xml structure. I h… --- ## [Protecting Kibana on the Internet](https://discuss.elastic.co/t/protecting-kibana-on-the-internet/288308)
**Author:** [@tsousahs](https://discuss.elastic.co/u/tsousahs)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 12:45am UTC](https://discuss.elastic.co/t/protecting-kibana-on-the-internet/288308 "2021-11-04T00:45:37Z")
Hello, We are thinking in putting our Kibana instance publicly, base on client IP Address, on the Internet to give access to it to our customers. Is Kibana sufficiently secure to be putted on the Internet? Do you recom… --- ## [Clone index API vs. Scan and Scroll API](https://discuss.elastic.co/t/clone-index-api-vs-scan-and-scroll-api/288311)
**Author:** [@madshov](https://discuss.elastic.co/u/madshov)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 12:13am UTC](https://discuss.elastic.co/t/clone-index-api-vs-scan-and-scroll-api/288311 "2021-11-04T00:13:12Z")
Hi, What's the better way to create a clone of my index for reindex purposes? Use the clone API or the scroll API and then bulk index? What are the pro and cons of each method? --- ## [Access from the Local Network](https://discuss.elastic.co/t/access-from-the-local-network/288351)
**Author:** [@SteveP](https://discuss.elastic.co/u/SteveP)\ **Replies:** 5\ **Last updated:** [November 4, 2021, 12:10am UTC](https://discuss.elastic.co/t/access-from-the-local-network/288351 "2021-11-04T00:10:29Z")
I have a one node Elasticsearch server that is sitting on 192.168.30.6. I would like a number of devices, on different local subnets to be able to hit this server on port 9200. I have my Elasticsearch.yml configured so t… --- ## [Old Elasticsearch Plugin location](https://discuss.elastic.co/t/old-elasticsearch-plugin-location/288368)
**Author:** [@Edgar1](https://discuss.elastic.co/u/Edgar1)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 12:06am UTC](https://discuss.elastic.co/t/old-elasticsearch-plugin-location/288368 "2021-11-04T00:06:10Z")
I'm trying to find old plugins for the 2.x.x version of Elasticsearch. Specifically I'm looking for the repository-s3 plugin. I tried using the command sudo bin/elasticsearch-plugin install repository-s3 and sudo bin/plu… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1174) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1176)